EUVD-2026-62599Severity by source
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Spec content is network-deliverable (AV:N) with no auth (PR:N), but a victim must run codegen and execute generated code (UI:R), and execution escapes Orval into the host/CI context (S:C) with full code execution (C/I/A:H).
Primary rating from Vendor (GitHub_M).
CVSS VectorVendor: GitHub_M
CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:X/CR:X/IR:X/AR:X/MAV:X/MAC:X/MAT:X/MPR:X/MUI:X/MVC:X/MVI:X/MVA:X/MSC:X/MSI:X/MSA:X/S:X/AU:X/R:X/V:X/RE:X/U:X
Lifecycle Timeline
4DescriptionCVE.org
Orval generates type-safe JavaScript clients in TypeScript from OpenAPI v3 and Swagger v2 specifications. Prior to 8.21.0, an unescaped backtick in an OpenAPI path is emitted into request URL template literals generated for axios, fetch, react-query, and SWR clients without safe encoding. This permits attacker-controlled JavaScript to be evaluated when a generated request, URL-builder, or query-key function is called, resulting in code execution in the developer, CI, test, or application environment. The affected code is packages/core/src/getters/route.ts and route generation consumers. This issue is fixed in version 8.21.0.
AnalysisAI
Code injection in Orval before 8.21.0 lets an attacker who controls an OpenAPI v3 or Swagger v2 specification embed executable JavaScript into generated client code. An unescaped backtick (and ${...} / backslash) in an OpenAPI path, server URL, or server-variable default is emitted verbatim into the template literals Orval generates for axios, fetch, react-query, and SWR clients, so attacker-controlled code runs whenever a generated request, URL-builder, or query-key function is invoked - inside the developer machine, CI pipeline, test suite, or running application. …
Unlock full vulnerability intelligence
- Risk assessment & exploitation conditions
- Attack chain visualization
- Remediation with exact patch versions
- Threat intelligence from 22 sources
- Personal watchlist & email alerts
Free forever · No credit card required
Attack ChainAIDerived
Hypothetical attack flow derived from CVE metadata
Vulnerability AssessmentAI
| Exploitation | Requires that Orval (< 8.21.0) ingest an attacker-influenced OpenAPI v3 or Swagger v2 specification in which a path segment, servers[].url, or server-variable default contains an unescaped backtick, `${...}` interpolation, or backslash; the victim must then generate an axios/fetch/react-query/SWR client and subsequently invoke the generated request, URL-builder, or query-key function (or run tests/build that do so) for the injected JavaScript to execute. … Additional conditions and limiting factors are described in the full assessment. |
| Risk Assessment | The vendor CVSS 4.0 vector (AV:N/AC:L/AT:N/PR:N/UI:N, VC/VI/VA:H = 9.3 Critical) treats this as trivially exploitable code execution, and CWE-94 with confirmed vendor patch supports high severity. … Full risk analysis with EPSS, KEV, and SSVC signal comparison available after sign-in. |
| Exploit Scenario | An attacker publishes or supplies an OpenAPI spec whose path or server URL contains a payload such as `http://api.x/`+require('fs').writeFileSync('/marker','pwned')+`; a developer or CI job runs Orval against that spec, and the injected JavaScript becomes part of the generated request/URL-builder/query-key function. When that function is called (during tests, build, or app runtime), the attacker's code executes with the privileges of the developer or CI environment. … |
| Remediation | Vendor-released patch: upgrade Orval to 8.21.0 or later (https://github.com/orval-labs/orval/releases/tag/v8.21.0; fix in PR https://github.com/orval-labs/orval/pull/3692, commit 8ef1bfdf3f9bcaf9dabfbe2e42887f1c0e159ab6), which escapes spec-derived strings via jsStringLiteralEscape/jsesc before emitting them into template literals. … Detailed patch versions, workarounds, and compensating controls in full report. |
Recommended ActionAI
Within 24 hours, identify all projects and CI/CD pipelines using Orval and determine which OpenAPI specifications they consume-particularly any from external or third-party sources. …
Sign in for detailed remediation steps and compensating controls.
Threat intelligence, references, and detailed analysis are available after sign-in.
orval (TypeScript API client generator) before 7.18.0 has code injection via OpenAPI specification summary fields in MCP
Orval TypeScript code generator versions 7.19+ have a command injection vulnerability allowing RCE through malicious Ope
Orval, a TypeScript API client generator, has a command injection vulnerability that allows code execution through malic
Code injection in Orval TypeScript API client generator versions 7.19.0 to before 7.22.0. Generated client code may be v
Arbitrary code execution in Orval before 8.21.0 arises when the code generator emits an unescaped backtick (or ${...}) f
Arbitrary code execution in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swag
Code injection in Orval, a TypeScript/JavaScript API client generator, allows a malicious OpenAPI v3 or Swagger v2 speci
Code execution in Orval before 8.21.0 occurs when its zod schema generator processes an attacker-controlled OpenAPI v3 o
Code injection in Orval before 8.21.0 lets an attacker-controlled OpenAPI v3 / Swagger v2 specification achieve arbitrar
Arbitrary code execution in Orval (OpenAPI/Swagger TypeScript client generator) before 8.21.0 lets an attacker who contr
Code injection in Orval (orval-labs/orval) before 8.21.0 allows an attacker who controls an OpenAPI v3 or Swagger v2 spe
Code injection in Orval, a TypeScript client generator for OpenAPI v3 and Swagger v2 specs, allows arbitrary JavaScript
Same weakness CWE-94 – Code Injection
View allSame technique Code Injection
View allShare
External POC / Exploit Code
Leaving vuln.today